TooTallNate/Java-WebSocket · error · LimitExceededException

Payloadsize is to little...

Error message

Payloadsize is to little...

What it means

translateSingleFrameCheckLengthLimit throws LimitExceededException("Payloadsize is to little...") when the computed payload length is negative. Since lengths are decoded as unsigned longs, a negative value indicates an arithmetic overflow during length accumulation (e.g. adding extended length bytes overflowed).

Solutions

1. Reject the connection/close with protocol error (1002) on catching LimitExceededException
2. Ensure the peer sends RFC-compliant frames; treat as malicious input if it persists
3. Update Java-WebSocket to a version where length accumulation is overflow-safe
4. Add input sanitization/logging at the network boundary to identify the offending peer

try {
  conn.send(msg);
} catch (LimitExceededException e) {
  log.error("Payload length underflow — corrupt/malicious peer", e);
  conn.close(CloseFrame.PROTOCOL_ERROR, "bad frame length");
}

When it happens

Trigger: Overflow while accumulating payloadlength in translateSingleFrame/translateSingleFramePayloadLength (e.g. length * 256 + byte wrapping negative) produces length < 0, hitting the underflow check.

Common situations: Malicious or corrupt frames with adversarial 64-bit length fields; fuzzing; integer overflow in hand-rolled length parsing upstream of the check.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• Payloadsize is to big...
• Payload limit reached.
• buffer size < 0
• parameter must not be null
• Invalid SSL status:

AI-assisted analysis of TooTallNate/Java-WebSocket@afeacbf8c0 (2026-09-09). Data as JSON: /api/errors/a55c8cf968bbabd0. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/org/java_websocket/drafts/Draft_6455.java:659

  /**
   * Check if the frame size exceeds the allowed limit
   *
   * @param length the current payload length
   * @throws LimitExceededException if the payload length is to big
   */
  private void translateSingleFrameCheckLengthLimit(long length) throws LimitExceededException {
    if (length > Integer.MAX_VALUE) {
      log.trace("Limit exedeed: Payloadsize is to big...");
      throw new LimitExceededException("Payloadsize is to big...");
    }
    if (length > maxFrameSize) {
      log.trace("Payload limit reached. Allowed: {} Current: {}", maxFrameSize, length);
      throw new LimitExceededException("Payload limit reached.", maxFrameSize);
    }
    if (length < 0) {
      log.trace("Limit underflow: Payloadsize is to little...");
      throw new LimitExceededException("Payloadsize is to little...");
    }
  }

  /**
   * Check if the max packet size is smaller than the real packet size
   *
   * @param maxpacketsize  the max packet size
   * @param realpacketsize the real packet size
   * @throws IncompleteException if the maxpacketsize is smaller than the realpackagesize
   */
  private void translateSingleFrameCheckPacketSize(int maxpacketsize, int realpacketsize)
      throws IncompleteException {
    if (maxpacketsize < realpacketsize) {
      log.trace("Incomplete frame: maxpacketsize < realpacketsize");
      throw new IncompleteException(realpacketsize);
    }
  }

View on GitHub (pinned to afeacbf8c0)